{"record":{"id":"a1b9230afa66c75d","repo":"abhigyanpatwari/GitNexus","slug":"oracle-sanitization-requires-a-self-contained-clon","errorCode":null,"errorMessage":"oracle sanitization requires a self-contained clone: {root}","messagePattern":"oracle sanitization requires a self-contained clone: (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"critical","filePath":"eval/workflow_bench/oracle_assets.py","lineNumber":258,"sourceCode":"    return result.stdout_tail.strip()\n\n\ndef sanitize_clone_for_hidden_oracles(clone: Path) -> str:\n    \"\"\"Remove the harness and its recoverable Git history from a disposable clone.\n\n    A read-only mount over the checked-out harness is insufficient: a model\n    could recover committed oracle bytes with ``git show``. Build a parentless\n    commit from the clone's existing index after removing the complete harness,\n    discard every other reference/reflog, and prune unreachable objects before\n    any task asset, setup command, or model session is allowed to run.\n    \"\"\"\n\n    root = clone.expanduser().absolute()\n    try:\n        root_metadata = root.lstat()\n        git_metadata = (root / \".git\").lstat()\n    except OSError as exc:\n        raise ValueError(f\"oracle sanitization requires a self-contained clone: {root}\") from exc\n    if (\n        stat.S_ISLNK(root_metadata.st_mode)\n        or not stat.S_ISDIR(root_metadata.st_mode)\n        or root.resolve(strict=True) != root\n        or stat.S_ISLNK(git_metadata.st_mode)\n        or not stat.S_ISDIR(git_metadata.st_mode)\n    ):\n        raise ValueError(f\"oracle sanitization requires a real self-contained clone: {root}\")\n\n    original_head = _git_checked(root, [\"rev-parse\", \"--verify\", \"HEAD^{commit}\"])\n    if len(original_head) not in {40, 64} or any(\n        character not in \"0123456789abcdefABCDEF\" for character in original_head\n    ):\n        raise ValueError(\"clone HEAD is not an immutable commit\")\n\n    hidden_tree_result = run_managed(\n        [\n            \"git\",","sourceCodeStart":240,"sourceCodeEnd":276,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/d540b00184d71a896261ee02670da9a92d59d8f7/eval/workflow_bench/oracle_assets.py#L240-L276","documentation":"Raised by sanitize_clone_for_hidden_oracles when lstat() on either the clone root or its '.git' entry raises OSError. The function requires a self-contained clone (a real directory plus a real '.git' directory) so it can surgically rewrite history and remove recoverable oracle bytes. If the root or .git cannot even be stat-ed, sanitization cannot proceed safely.","triggerScenarios":"Calling sanitize_clone_for_hidden_oracles(clone) where clone does not exist; '.git' does not exist (not a git repo); clone is on an unmounted/inaccessible path; permissions deny lstat.","commonSituations":"Passing a plain working directory that was never `git clone`-ed; pointing at a path where the clone was deleted; running in CI where the clone step was skipped or failed; a shallow/broken clone missing '.git'.","solutions":["Pass a real git clone directory that contains a '.git' entry.","Re-run the clone step that produces the disposable clone before calling sanitize.","Confirm the path exists and is accessible (ls -la <clone> shows '.git').","Check that the harness process has permission to lstat the root and '.git'."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"from pathlib import Path\n\ndef assert_clone_ready(clone: Path) -> None:\n    root = clone.expanduser().absolute()\n    if not root.is_dir() or not (root / \".git\").exists():\n        raise FileNotFoundError(f\"clone missing root or .git: {root}\")","typeGuard":"def is_self_contained_clone(clone) -> bool:\n    root = Path(clone).expanduser().absolute()\n    return root.is_dir() and (root / \".git\").exists()","tryCatchPattern":"try:\n    head = sanitize_clone_for_hidden_oracles(clone)\nexcept ValueError as exc:\n    if \"self-contained clone\" in str(exc):\n        raise SystemExit(f\"Re-clone a real git repo: {exc}\") from exc\n    raise","preventionTips":["Always sanitize a fresh `git clone` output, never an arbitrary directory.","Verify `.git` exists in the clone before invoking sanitize.","Run sanitization in CI right after the clone step."],"tags":["python","benchmark","oracle","security","git","sanitization","filesystem"],"backgroundTag":null,"analyzedSha":"d540b00184d71a896261ee02670da9a92d59d8f7","analyzedAt":"2026-08-12T19:50:25.132Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}